jishushell 0.0.1 → 0.4.2

package/dist/auth.js

@@ -0,0 +1,88 @@
+import { AUTH_FILE, getJwtSecret, JWT_ALGORITHM, JWT_EXPIRE_HOURS } from "./config.js";
+import { safeReadJson, safeWriteJson } from "./utils/safe-json.js";
+import bcrypt from "bcryptjs";
+import jwt from "jsonwebtoken";
+const AUTH_CACHE_TTL = 60_000;
+let _authCache = null;
+// In-process mutex: prevents two concurrent /api/auth/init calls from both
+// seeing isInitialized()=false and then racing to write the password file.
+let _initInProgress = false;
+function invalidateAuthCache() { _authCache = null; }
+function readAuthData() {
+    return safeReadJson(AUTH_FILE, "auth");
+}
+function writeAuthData(data) {
+    safeWriteJson(AUTH_FILE, data, true);
+}
+export function isInitialized() {
+    return readAuthData() !== null;
+}
+export async function initPassword(password) {
+    // CAS: first caller wins; subsequent concurrent calls see _initInProgress=true
+    // and return false before even touching the file.
+    if (_initInProgress || readAuthData() !== null)
+        return false;
+    _initInProgress = true;
+    try {
+        // Double-check after the flag is set — in case two calls raced to the check above.
+        if (readAuthData() !== null)
+            return false;
+        const hashed = await bcrypt.hash(password, 10);
+        const version = Date.now();
+        writeAuthData({ password_hash: hashed, password_version: version });
+        invalidateAuthCache();
+        return true;
+    }
+    finally {
+        _initInProgress = false;
+    }
+}
+export async function verifyPassword(password) {
+    const data = readAuthData();
+    if (!data)
+        return false;
+    return bcrypt.compare(password, data.password_hash);
+}
+export async function changePassword(oldPassword, newPassword) {
+    if (!await verifyPassword(oldPassword))
+        return false;
+    const hashed = await bcrypt.hash(newPassword, 10);
+    let currentVersion = Date.now();
+    const data = readAuthData();
+    if (data) {
+        const prev = data.password_version || 0;
+        if (currentVersion <= prev)
+            currentVersion = prev + 1;
+    }
+    writeAuthData({ password_hash: hashed, password_version: currentVersion });
+    invalidateAuthCache();
+    return true;
+}
+export function createToken() {
+    const data = readAuthData();
+    const passwordVersion = data?.password_version || 1;
+    return jwt.sign({ sub: "admin", pv: passwordVersion }, getJwtSecret(), {
+        algorithm: JWT_ALGORITHM,
+        expiresIn: `${JWT_EXPIRE_HOURS}h`,
+    });
+}
+export function verifyToken(token) {
+    if (!token)
+        return false;
+    try {
+        const decoded = jwt.verify(token, getJwtSecret(), { algorithms: [JWT_ALGORITHM] });
+        if (_authCache && Date.now() - _authCache.ts < AUTH_CACHE_TTL) {
+            return decoded.pv === _authCache.passwordVersion;
+        }
+        const data = readAuthData();
+        if (!data)
+            return false;
+        const currentVersion = data.password_version || 1;
+        _authCache = { passwordVersion: currentVersion, ts: Date.now() };
+        return decoded.pv === currentVersion;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,GAAG,MAAM,cAAc,CAAC;AAO/B,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,IAAI,UAAU,GAAmD,IAAI,CAAC;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,SAAS,mBAAmB,KAAW,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC;AAE3D,SAAS,YAAY;IACnB,OAAO,YAAY,CAAW,SAAS,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,EAAE,KAAK,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI,eAAe,IAAI,YAAY,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7D,eAAe,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,mFAAmF;QACnF,IAAI,YAAY,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,aAAa,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,WAAmB;IAC3E,IAAI,CAAC,MAAM,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QACxC,IAAI,cAAc,IAAI,IAAI;YAAE,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,aAAa,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,mBAAmB,EAAE,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,eAAe,GAAG,IAAI,EAAE,gBAAgB,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE;QACrE,SAAS,EAAE,aAAa;QACxB,SAAS,EAAE,GAAG,gBAAgB,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,CAAmB,CAAC;QAErG,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,eAAe,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAClD,UAAU,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,EAAE,KAAK,cAAc,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,290 @@
+#!/usr/bin/env node
+if (process.platform === "darwin") {
+    const extra = ["/usr/local/bin", "/opt/homebrew/bin", "/opt/homebrew/sbin", "/Applications/Docker.app/Contents/Resources/bin"];
+    const current = process.env.PATH ?? "";
+    const missing = extra.filter(p => !current.split(":").includes(p));
+    if (missing.length > 0)
+        process.env.PATH = [...missing, current].join(":");
+}
+import { existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { exec } from "child_process";
+import { createServer } from "./server.js";
+import { runInstall, parseInstallArgs } from "./install.js";
+import { startPanel, stopPanel, stopWithJobs, restartPanel, runDoctor, runOnboard, showStatus, resetAll, checkUpdate, runUpdate } from "./control.js";
+const JISHUSHELL_HOME = process.env.JISHUSHELL_HOME || join(homedir(), ".jishushell");
+const NOMAD_BIN = join(JISHUSHELL_HOME, "bin", "nomad");
+const PANEL_PORT = 8090;
+function openBrowser(url) {
+    const platform = process.platform;
+    const cmd = platform === "darwin" ? `open "${url}"`
+        : platform === "win32" ? `start "" "${url}"`
+            : `xdg-open "${url}"`;
+    exec(cmd, () => { });
+}
+const [subcommand, ...rest] = process.argv.slice(2);
+// ── Helper to parse --port from remaining args ─────────────────────────────
+function parsePort(args) {
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--port" && args[i + 1]) {
+            const p = parseInt(args[i + 1], 10);
+            if (!isNaN(p) && p > 0 && p < 65536)
+                return p;
+        }
+    }
+    return undefined;
+}
+// ── install subcommand ─────────────────────────────────────────────────────
+if (subcommand === "install") {
+    const opts = parseInstallArgs(rest);
+    runInstall(opts).catch((err) => {
+        console.error("Installation failed:", err);
+        process.exit(1);
+    });
+    // runInstall is async and calls process.exit() itself
+    // ── start ──────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "start") {
+    startPanel(parsePort(rest)).then(() => process.exit(0)).catch((err) => {
+        console.error("start failed:", err.message);
+        process.exit(1);
+    });
+    // ── stop ───────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "stop") {
+    // --jobs: also stop (but not purge) all Nomad jobs before stopping the panel
+    const withJobs = rest.includes("--jobs") || rest.includes("-j");
+    const stopFn = withJobs ? stopWithJobs : stopPanel;
+    stopFn().then(() => process.exit(0)).catch((err) => {
+        console.error("stop failed:", err.message);
+        process.exit(1);
+    });
+    // ── restart ────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "restart") {
+    restartPanel(parsePort(rest)).then(() => process.exit(0)).catch((err) => {
+        console.error("restart failed:", err.message);
+        process.exit(1);
+    });
+    // ── status ─────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "status") {
+    showStatus().then(() => process.exit(0)).catch((err) => {
+        console.error("status failed:", err.message);
+        process.exit(1);
+    });
+    // ── doctor ─────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "doctor") {
+    const fix = rest.includes("--fix") || rest.includes("-f");
+    runDoctor({ fix }).then((ok) => process.exit(ok ? 0 : 1)).catch((err) => {
+        console.error("doctor failed:", err.message);
+        process.exit(1);
+    });
+    // ── onboard ────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "onboard") {
+    const force = rest.includes("--force") || rest.includes("-f");
+    runOnboard({ force }).then(() => process.exit(0)).catch((err) => {
+        console.error("onboard failed:", err.message);
+        process.exit(1);
+    });
+    // ── reset ──────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "reset") {
+    const yes = rest.includes("--yes") || rest.includes("-y");
+    resetAll({ yes }).then(() => process.exit(0)).catch((err) => {
+        console.error("reset failed:", err.message);
+        process.exit(1);
+    });
+    // ── update-check ───────────────────────────────────────────────────────────
+}
+else if (subcommand === "update-check") {
+    checkUpdate().then((info) => {
+        console.log(JSON.stringify(info));
+        process.exit(info.hasUpdate ? 0 : 1);
+    }).catch((err) => {
+        console.error("update-check failed:", err.message);
+        process.exit(2);
+    });
+    // ── update-run ─────────────────────────────────────────────────────────────
+}
+else if (subcommand === "update") {
+    runUpdate().then(() => process.exit(0)).catch((err) => {
+        console.error("update-run failed:", err.message);
+        process.exit(1);
+    });
+    // ── pairing: approve / list DM pairing requests inside running containers ──
+}
+else if (subcommand === "pairing") {
+    const action = rest[0];
+    // Parse --instance <id> flag
+    let instanceId;
+    const instIdx = rest.indexOf("--instance");
+    if (instIdx !== -1 && rest[instIdx + 1])
+        instanceId = rest[instIdx + 1];
+    if (action === "list") {
+        const { runPairingList } = await import("./control.js");
+        runPairingList({ instanceId }).then((ok) => process.exit(ok ? 0 : 1)).catch((err) => {
+            console.error("pairing list failed:", err.message);
+            process.exit(1);
+        });
+    }
+    else if (action === "approve") {
+        // args after "approve": [channel, code] or [code] (single-arg form)
+        const actionArgs = rest.slice(1).filter((a) => !a.startsWith("--") && a !== instanceId);
+        let channel;
+        let code;
+        if (actionArgs.length >= 2) {
+            [channel, code] = actionArgs;
+        }
+        else if (actionArgs.length === 1) {
+            channel = "feishu";
+            code = actionArgs[0];
+        }
+        else {
+            console.error("Usage: jishushell pairing approve <channel> <code> [--instance <id>]");
+            process.exit(1);
+        }
+        const notify = rest.includes("--notify");
+        const { runPairingApprove } = await import("./control.js");
+        runPairingApprove({ instanceId, channel, code, notify }).then((ok) => process.exit(ok ? 0 : 1)).catch((err) => {
+            console.error("pairing approve failed:", err.message);
+            process.exit(1);
+        });
+    }
+    else {
+        console.log(`
+Usage: jishushell pairing <command> [options]
+
+Commands:
+  list                               列出等待审批的配对请求
+  approve <channel> <code>           审批配对码（例: feishu LVU7PNYK）
+  approve <code>                     默认 channel=feishu 简写形式
+
+Options:
+  --instance <id>   指定实例 ID（只有一个实例时可省略）
+  --notify          审批后通知申请方
+
+Examples:
+  jishushell pairing list
+  jishushell pairing approve feishu LVU7PNYK
+  jishushell pairing approve LVU7PNYK
+  jishushell pairing approve feishu LVU7PNYK --instance my-instance
+`);
+        process.exit(1);
+    }
+    // ── serve: foreground server (used by systemd/launchd ExecStart) ──────────
+}
+else if (subcommand === "serve") {
+    const args = rest;
+    let port = PANEL_PORT;
+    let host = "0.0.0.0";
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--port" && args[i + 1]) {
+            const parsed = parseInt(args[i + 1], 10);
+            if (isNaN(parsed) || parsed < 1 || parsed > 65535) {
+                console.error(`Invalid port: ${args[i + 1]}. Must be 1-65535.`);
+                process.exit(1);
+            }
+            port = parsed;
+            i++;
+        }
+        else if (args[i] === "--host" && args[i + 1]) {
+            host = args[i + 1];
+            i++;
+        }
+    }
+    createServer({ port, host }).catch((err) => {
+        console.error("serve failed:", err.message);
+        process.exit(1);
+    });
+    // ── uninstall ─────────────────────────────────────────────────────────────
+}
+else if (subcommand === "uninstall") {
+    const yes = rest.includes("--yes") || rest.includes("-y");
+    const { spawnSync } = await import("child_process");
+    const uninstallSh = join(JISHUSHELL_HOME, "install", "post-uninstall.sh");
+    if (!existsSync(uninstallSh)) {
+        console.error(`Uninstall script not found: ${uninstallSh}`);
+        console.error("Please run: sudo bash ~/.jishushell/install/jishu-uninstall.sh --data --yes");
+        process.exit(1);
+    }
+    if (!yes) {
+        const { createInterface } = await import("readline");
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        await new Promise((resolve) => {
+            rl.question("This will stop all services, remove auto-start and delete ~/.jishushell. Continue? [y/N] ", (ans) => {
+                rl.close();
+                if (ans.toLowerCase() !== "y") {
+                    console.log("Cancelled.");
+                    process.exit(0);
+                }
+                resolve();
+            });
+        });
+    }
+    // Step 1: stop services and remove ~/.jishushell via the backed-up script
+    const cleanResult = spawnSync("bash", [uninstallSh], { stdio: "inherit" });
+    // Step 2: remove the npm global package (now ~/.jishushell is already gone)
+    const npmResult = spawnSync("npm", ["uninstall", "-g", "jishushell"], { stdio: "inherit" });
+    process.exit((cleanResult.status ?? 0) || (npmResult.status ?? 0));
+    // ── help ───────────────────────────────────────────────────────────────────
+}
+else if (!subcommand || subcommand === "help" || subcommand === "--help" || subcommand === "-h") {
+    console.log(`
+JishuShell — OpenClaw 实例管理面板
+
+Usage:
+  jishushell                       前台启动面板服务器
+  jishushell <command> [options]
+
+Commands:
+  status                           显示各模块运行状态（面板、Docker、Nomad 及所有 Job）
+  serve [--port N] [--host H]       前台启动面板服务器（供 systemd/launchd 使用）
+  start [--port N]                 在后台启动面板
+  stop [--jobs]                    停止面板；加 --jobs 同时停止所有 Nomad Job
+  restart [--port N]               重启面板
+  doctor                           检查所有组件健康状态
+  doctor --fix                     检查并尝试自动修复问题
+  onboard [--force]                首次引导：设置管理员密码
+  reset [--yes]                    重置配置与所有 Nomad Job（保留实例数据目录）
+  uninstall [--yes]                停止服务、删除 ~/.jishushell 并卸载 npm 包
+  update-check                     检查是否有新版本（0=有新版本，1=已是最新）
+  update                           安装最新版本并重启面板
+  install [options]                安装依赖并配置 JishuShell
+  pairing list                     列出等待审批的 DM 配对请求
+  pairing approve <ch> <code>      审批飞书/Lark 配对码（在容器内执行）
+  help                             显示此帮助信息
+
+Server options:
+  --port <port>    监听端口（默认 8090 或 panel.json 中的值）
+  --host <host>    监听地址（默认 0.0.0.0）
+
+Install options:
+  --port <port>    面板端口（默认 8090）
+  --yes, -y        跳过所有交互提示（非交互模式）
+  --no-service     跳过 systemd/launchd 注册
+  --skip-docker    跳过 Docker 安装
+  --skip-nomad     跳过 Nomad 安装
+  --skip-openclaw  跳过 OpenClaw 安装
+  --force, -f      即使已配置也强制重新安装
+  --dry-run, -n    预演，不实际执行任何变更
+
+Examples:
+  jishushell status               # 查看当前所有组件状态
+  jishushell start                # 后台启动面板
+  jishushell stop --jobs          # 停止面板及所有实例 Job
+  jishushell restart              # 重启面板
+  jishushell doctor --fix         # 检查并自动修复
+  jishushell reset --yes          # 非交互式重置（CI 场景）
+`);
+    process.exit(0);
+    // ── unknown command ────────────────────────────────────────────────────────
+}
+else {
+    console.error(`Unknown command: ${subcommand}\nRun 'jishushell help' for usage.`);
+    process.exit(1);
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,iDAAiD,CAAC,CAAC;IAC/H,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEtJ,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACtF,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,GAAG,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG;QACjD,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG;YAC5C,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEpD,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAc;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,sDAAsD;IAExD,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;IAClC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACpE,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACjC,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;IACpC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACtE,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;IACnC,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACrD,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1D,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACtE,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9D,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9D,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1D,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;IACzC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;IACnC,SAAS,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACpD,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,8EAA8E;AAC9E,CAAC;KAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,6BAA6B;IAC7B,IAAI,UAA8B,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QAAE,UAAU,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAExE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACxD,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAClF,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,oEAAoE;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;QACxF,IAAI,OAAe,CAAC;QACpB,IAAI,IAAY,CAAC;QACjB,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC3B,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC;QAC/B,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,GAAG,QAAQ,CAAC;YACnB,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;YACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3D,iBAAiB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5G,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;CAiBf,CAAC,CAAC;QACC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAEH,6EAA6E;AAC7E,CAAC;KAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC;IAClB,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,IAAI,IAAI,GAAG,SAAS,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;gBAClD,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,GAAG,MAAM,CAAC;YACd,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/C,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,6EAA6E;AAC7E,CAAC;KAAM,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,+BAA+B,WAAW,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,EAAE,CAAC,QAAQ,CAAC,2FAA2F,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC/G,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;oBAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC9E,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,0EAA0E;IAC1E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,4EAA4E;IAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IAErE,8EAA8E;AAC9E,CAAC;KAAM,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;IAClG,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8Cb,CAAC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAElB,8EAA8E;AAC9E,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,oCAAoC,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,24 @@
+export declare const JISHUSHELL_HOME: string;
+export declare const INSTANCES_DIR: string;
+export declare const AUTH_FILE: string;
+export declare const PANEL_CONFIG_FILE: string;
+export declare function getJwtSecret(): string;
+export declare const JWT_ALGORITHM: "HS256";
+export declare const JWT_EXPIRE_HOURS = 24;
+export declare const OPENCLAW_BIN: string;
+export declare const DEFAULT_OPENCLAW_DOCKER_IMAGE = "jishushell-openclaw:local";
+export declare const CUSTOM_IMAGE_PREFIX = "jishushell-openclaw";
+export declare function getOpenclawDockerImage(): string;
+/** Check whether the image is an official remote image (ghcr.io/openclaw/openclaw). */
+export declare function isOfficialImage(image?: string): boolean;
+export declare function setOpenclawDockerImage(tag: string): void;
+export declare function ensureDirs(): void;
+export declare function getPanelConfig(): Record<string, any>;
+export declare function savePanelConfig(config: Record<string, any>): Record<string, any>;
+export declare function ensurePanelConfig(): void;
+export declare function getServiceManagerType(): string;
+export declare function getNomadDriver(): string;
+export declare function getNomadToken(): string;
+export declare function getDeviceId(): string;
+export declare function getAesKey(): Buffer;
+export declare function getNomadAddr(): string;

package/dist/config.js

@@ -0,0 +1,226 @@
+import { execFileSync } from "child_process";
+import { randomBytes } from "crypto";
+import { chmodSync, closeSync, existsSync, fdatasyncSync, mkdirSync, openSync, readFileSync, writeFileSync } from "fs";
+import { generateFingerprint } from "./services/telemetry/device-fingerprint.js";
+import { homedir } from "os";
+import { dirname, join, resolve } from "path";
+import { safeReadJson, safeWriteJson } from "./utils/safe-json.js";
+import { TtlCache } from "./utils/ttl-cache.js";
+export const JISHUSHELL_HOME = resolve(process.env.JISHUSHELL_HOME || join(homedir(), ".jishushell"));
+export const INSTANCES_DIR = join(JISHUSHELL_HOME, "instances");
+export const AUTH_FILE = join(JISHUSHELL_HOME, "auth.json");
+export const PANEL_CONFIG_FILE = join(JISHUSHELL_HOME, "panel.json");
+const JWT_SECRET_FILE = join(JISHUSHELL_HOME, "jwt-secret");
+let _jwtSecret = null;
+export function getJwtSecret() {
+    if (_jwtSecret)
+        return _jwtSecret;
+    // 1. Environment variable takes precedence
+    if (process.env.JISHUSHELL_JWT_SECRET) {
+        if (process.env.JISHUSHELL_JWT_SECRET.length < 32) {
+            throw new Error("JISHUSHELL_JWT_SECRET must be at least 32 characters for security");
+        }
+        _jwtSecret = process.env.JISHUSHELL_JWT_SECRET;
+        return _jwtSecret;
+    }
+    // 2. Read persisted secret
+    if (existsSync(JWT_SECRET_FILE)) {
+        const stored = readFileSync(JWT_SECRET_FILE, "utf-8").trim();
+        if (stored) {
+            _jwtSecret = stored;
+            return _jwtSecret;
+        }
+    }
+    // 3. Auto-generate and persist (fsync to protect against RPi power loss)
+    _jwtSecret = randomBytes(48).toString("base64url");
+    mkdirSync(dirname(JWT_SECRET_FILE), { recursive: true, mode: 0o700 });
+    writeFileSync(JWT_SECRET_FILE, _jwtSecret, { mode: 0o600 });
+    try {
+        const fd = openSync(JWT_SECRET_FILE, "r");
+        fdatasyncSync(fd);
+        closeSync(fd);
+    }
+    catch { }
+    return _jwtSecret;
+}
+export const JWT_ALGORITHM = "HS256";
+export const JWT_EXPIRE_HOURS = 24;
+export const OPENCLAW_BIN = process.env.OPENCLAW_BIN || "openclaw-gateway";
+// Default Docker image: locally built from npm package + Python.
+export const DEFAULT_OPENCLAW_DOCKER_IMAGE = "jishushell-openclaw:local";
+const OFFICIAL_IMAGE_PREFIX = "ghcr.io/openclaw/openclaw";
+// Custom image built locally (npm install openclaw + Python)
+export const CUSTOM_IMAGE_PREFIX = "jishushell-openclaw";
+export function getOpenclawDockerImage() {
+    if (process.env.OPENCLAW_DOCKER_IMAGE)
+        return process.env.OPENCLAW_DOCKER_IMAGE;
+    const stored = getPanelConfig().openclaw_image;
+    if (typeof stored === "string" && stored.trim())
+        return stored;
+    // panel.json has no image — try scanning local Docker daemon
+    try {
+        const lines = execFileSync("docker", ["images", "--format", "{{.Repository}}:{{.Tag}}"], { encoding: "utf8", timeout: 5000 }).split("\n");
+        const found = lines.find((l) => l.startsWith(CUSTOM_IMAGE_PREFIX + ":"))
+            || lines.find((l) => l.startsWith(OFFICIAL_IMAGE_PREFIX + ":"));
+        if (found) {
+            // Persist so we don't scan every call
+            setOpenclawDockerImage(found);
+            return found;
+        }
+    }
+    catch { }
+    return DEFAULT_OPENCLAW_DOCKER_IMAGE;
+}
+/** Check whether the image is an official remote image (ghcr.io/openclaw/openclaw). */
+export function isOfficialImage(image) {
+    const img = image || getOpenclawDockerImage();
+    return img.startsWith(OFFICIAL_IMAGE_PREFIX + ":") || img === OFFICIAL_IMAGE_PREFIX;
+}
+export function setOpenclawDockerImage(tag) {
+    const config = getPanelConfig();
+    config.openclaw_image = tag;
+    savePanelConfig(config);
+}
+export function ensureDirs() {
+    for (const dir of [JISHUSHELL_HOME, INSTANCES_DIR]) {
+        mkdirSync(dir, { recursive: true, mode: 0o775 });
+        try {
+            chmodSync(dir, 0o775);
+        }
+        catch { /* ignore if not owner */ }
+    }
+}
+const _panelConfigCache = new TtlCache(5_000);
+export function getPanelConfig() {
+    return structuredClone(_panelConfigCache.get(() => {
+        return safeReadJson(PANEL_CONFIG_FILE, "config") || {};
+    }));
+}
+export function savePanelConfig(config) {
+    safeWriteJson(PANEL_CONFIG_FILE, config, true);
+    _panelConfigCache.invalidate();
+    return config;
+}
+export function ensurePanelConfig() {
+    const defaults = {
+        service_manager: "nomad",
+        nomad_driver: "docker",
+    };
+    if (!existsSync(PANEL_CONFIG_FILE)) {
+        safeWriteJson(PANEL_CONFIG_FILE, JSON.stringify(defaults, null, 2), true);
+        _panelConfigCache.invalidate();
+    }
+    const cfg = getPanelConfig();
+    if (!cfg.openclaw_image) {
+        try {
+            const lines = execFileSync("docker", ["images", "--format", "{{.Repository}}:{{.Tag}}"], { encoding: "utf8", timeout: 5000 }).split("\n");
+            // Prefer custom image (with Python), then official, then legacy
+            const custom = lines.find((l) => l.startsWith(CUSTOM_IMAGE_PREFIX + ":"));
+            const official = lines.find((l) => l.startsWith(OFFICIAL_IMAGE_PREFIX + ":"));
+            const legacy = lines.find((l) => l.startsWith("openclaw:"));
+            const raw = custom || official || legacy || "";
+            if (raw) {
+                cfg.openclaw_image = raw;
+                savePanelConfig({ ...defaults, ...cfg });
+            }
+        }
+        catch {
+        }
+    }
+}
+export function getServiceManagerType() {
+    return getPanelConfig().service_manager || "nomad";
+}
+export function getNomadDriver() {
+    const driver = getPanelConfig().nomad_driver || "docker";
+    if (driver === "raw_exec") {
+        console.warn("[config] raw_exec driver is disabled for security reasons, using docker instead");
+        return "docker";
+    }
+    return driver;
+}
+export function getNomadToken() {
+    return process.env.NOMAD_TOKEN || getPanelConfig().nomad_token || "";
+}
+const DEVICE_ID_FILE = join(JISHUSHELL_HOME, "device-id");
+let _deviceId = null;
+export function getDeviceId() {
+    if (_deviceId)
+        return _deviceId;
+    if (existsSync(DEVICE_ID_FILE)) {
+        const stored = readFileSync(DEVICE_ID_FILE, "utf-8").trim();
+        if (stored) {
+            _deviceId = stored;
+            return _deviceId;
+        }
+    }
+    _deviceId = generateFingerprint();
+    mkdirSync(dirname(DEVICE_ID_FILE), { recursive: true, mode: 0o700 });
+    writeFileSync(DEVICE_ID_FILE, _deviceId, { mode: 0o600 });
+    try {
+        const fd = openSync(DEVICE_ID_FILE, "r");
+        fdatasyncSync(fd);
+        closeSync(fd);
+    }
+    catch { }
+    return _deviceId;
+}
+const ENCRYPTION_KEY_FILE = join(JISHUSHELL_HOME, "encryption-key");
+let _aesKey = null;
+export function getAesKey() {
+    if (_aesKey)
+        return _aesKey;
+    // 1. Environment variable (hex string, 64 chars = 32 bytes)
+    const envKey = process.env.JISHUSHELL_AES_KEY;
+    if (envKey) {
+        const buf = Buffer.from(envKey, "hex");
+        if (buf.length !== 32)
+            throw new Error("JISHUSHELL_AES_KEY must be 64 hex chars (32 bytes)");
+        _aesKey = buf;
+        return _aesKey;
+    }
+    // 2. File-based key
+    if (existsSync(ENCRYPTION_KEY_FILE)) {
+        const buf = readFileSync(ENCRYPTION_KEY_FILE);
+        if (buf.length !== 32) {
+            throw new Error(`encryption-key file has invalid length ${buf.length}, expected 32 bytes. Fix or delete the file to regenerate.`);
+        }
+        _aesKey = buf;
+        return _aesKey;
+    }
+    // 3. Auto-generate and persist (fsync to protect against RPi power loss)
+    _aesKey = randomBytes(32);
+    mkdirSync(dirname(ENCRYPTION_KEY_FILE), { recursive: true, mode: 0o700 });
+    writeFileSync(ENCRYPTION_KEY_FILE, _aesKey, { mode: 0o600 });
+    try {
+        const fd = openSync(ENCRYPTION_KEY_FILE, "r");
+        fdatasyncSync(fd);
+        closeSync(fd);
+    }
+    catch { }
+    return _aesKey;
+}
+export function getNomadAddr() {
+    const addr = process.env.NOMAD_ADDR || "http://127.0.0.1:4646";
+    // When the user explicitly sets a remote NOMAD_ADDR, enforce HTTPS so that
+    // the ACL token carried in X-Nomad-Token is never transmitted in cleartext.
+    if (process.env.NOMAD_ADDR) {
+        let url;
+        try {
+            url = new URL(addr);
+        }
+        catch {
+            throw new Error(`NOMAD_ADDR "${addr}" is not a valid URL`);
+        }
+        const isLoopback = url.hostname === "127.0.0.1" ||
+            url.hostname === "::1" ||
+            url.hostname.toLowerCase() === "localhost";
+        if (!isLoopback && url.protocol !== "https:") {
+            throw new Error(`NOMAD_ADDR "${addr}" points to a remote host over plain HTTP. ` +
+                `The Nomad ACL token would be transmitted in cleartext. ` +
+                `Use HTTPS instead, e.g. NOMAD_ADDR=https://${url.host}`);
+        }
+    }
+    return addr;
+}
+//# sourceMappingURL=config.js.map